diff options
| author |   Sean Christopherson <seanjc@google.com> | 2025-01-31 17:55:10 -0800 |
|---|---|---|
| committer | Sean Christopherson <seanjc@google.com> | 2025-02-24 09:01:06 -0800 |
| commit | 3244616aac8dc69b3d7e4a4ee541e767b974af43 (patch) | |
| tree | f90993c0113858263946a4d9d8f2359c193bed94 | |
| parent | KVM: nSVM: Pass next RIP, not current RIP, for nested VM-Exit on emulation (diff) | |
| download | wireguard-linux-3244616aac8dc69b3d7e4a4ee541e767b974af43.tar.xz wireguard-linux-3244616aac8dc69b3d7e4a4ee541e767b974af43.zip | |
KVM: nVMX: Allow emulating RDPID on behalf of L2
Return X86EMUL_CONTINUE instead X86EMUL_UNHANDLEABLE when emulating RDPID
on behalf of L2 and L1 _does_ expose RDPID/RDTSCP to L2. When RDPID
emulation was added by commit fb6d4d340e05 ("KVM: x86: emulate RDPID"),
KVM incorrectly allowed emulation by default. Commit 07721feee46b ("KVM:
nVMX: Don't emulate instructions in guest mode") fixed that flaw, but
missed that RDPID emulation was relying on the common return path to allow
emulation on behalf of L2.
Fixes: 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest mode")
Link: https://lore.kernel.org/r/20250201015518.689704-4-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Diffstat (limited to '')
| -rw-r--r-- | arch/x86/kvm/vmx/vmx.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index e8672c4cb625..f03d1dc63de0 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -8049,18 +8049,19 @@ int vmx_check_intercept(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12 = get_vmcs12(vcpu); switch (info->intercept) { - /* - * RDPID causes #UD if disabled through secondary execution controls. - * Because it is marked as EmulateOnUD, we need to intercept it here. - * Note, RDPID is hidden behind ENABLE_RDTSCP. - */ case x86_intercept_rdpid: + /* + * RDPID causes #UD if not enabled through secondary execution + * controls (ENABLE_RDTSCP). Note, the implicit MSR access to + * TSC_AUX is NOT subject to interception, i.e. checking only + * the dedicated execution control is architecturally correct. + */ if (!nested_cpu_has2(vmcs12, SECONDARY_EXEC_ENABLE_RDTSCP)) { exception->vector = UD_VECTOR; exception->error_code_valid = false; return X86EMUL_PROPAGATE_FAULT; } - break; + return X86EMUL_CONTINUE; case x86_intercept_in: case x86_intercept_ins: |